After reaching a settlement with the Federal Trade Commission (FTC) and the US Department of Justice, Amazon agreed to pay $25 million on Wednesday over violating children’s privacy through its voice assistant Alexa.
Additionally, the settlement terms require Amazon to change the practices that led to privacy violations and inform users of such changes.
We take our responsibilities to our customers and their family seriously. We have consistently taken steps to protect customer privacy by providing clear privacy disclosures and customer controls, conducting ongoing audits and process improvements, and maintaining strict internal controls to protect customer data.Amazon
The Department of Justice filed a complaint on behalf of the FTC in May, alleging that Amazon was storing children’s voice recordings indefinitely.
The complaint also claimed that parents were prevented from exercising their rights to delete sensitive voice and geolocation data under the Children’s Online Privacy Protection Act Rule (COPPA Rule).
How Did Amazon Violate Children’s Privacy?
Filed in a Federal District Court in Washington, the lawsuit claimed that Amazon products integrated with the company’s voice assistant Alexa and directed towards children under 13 years of age violated the COPPA, the COPPA rule, and the FTC Act.
Whenever a verbal request is made on an Alexa-enabled device, Amazon saves the voice recording and creates a written transcript.
Brian Boynton, the principal deputy assistant attorney general and head of the Justice Department’s Civil Division, said the settlement reflects the DOJ’s dedication to protecting children online.
The COPPA requires companies to retain children’s voice recordings and geolocation data only as long as it was “reasonably necessary to fulfill the purposes they were collected for.
However, according to the complaint, Amazon retained this data indefinitely by default and “engaged in unfair privacy practices”.
Parents whose children have accounts are to be notified of the changes to its policies too.
The lawsuit also accused Amazon of deceiving Alexa users with false representations that they could delete any voice recordings, associated transcripts, and geolocation information.
Amazon, on several occasions, failed to delete all such information upon the user’s request and did not notify the consumers that it hadn’t honored their deletion request.
The complaint alleged that Amazon has been storing such voice records violating the COPPA since May 2018. The company retained them for its purposes “while putting data at risk of harm from unnecessary access,” claimed the Department of Justice.
The Settlement and Its Implications
Amazon will be paying $25 million in civilian penalties, as the federal district court’s order stipulated on Wednesday. The court also ordered Amazon to “identify and delete inactive child profiles,” i.e., those younger than 18.
The court order also prohibits the tech giant from retaining, accessing, or deleting voice and geological information, including children’s voice recordings.
It mandates deleting voice, geolocation, and children’s personal information upon the user’s or parent’s request, respectively.
